UserController::login() always echoed a generic "wrong credentials"
message on failure, discarding whatever User::login() returned - so a
locked-out account got the same message as a plain typo, with no way
to tell the user to wait instead of retrying immediately.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>